[driech]

I’ve spent considerable time on this problem (virus) with no success. While trying to upgrade my Window 2K from SP3 to SP4, I noticed that C:\winnt\system32\regsvr32.exe, or more correctly, REGSVR32.exe had a byte count of 0, which has been causing considerable problems when trying to install some applications.

I went into safe mode, replaced the defective regsvr32.exe with a good copy, and then rebooted normally. The file was again replaced with a zero byte file immediately after the system had completed rebooting.

After checking different sources on the Internet, I thought it MIGHT be a Norton system application that I have installed on my system for virus and firewall protection. However, I found out that this is NOT the case since my son’s PC had the identical problem and I rebuilt his machine up from a formatted system disk, reinstalled Win 2K and the associated Norton applications. His regsvr32.exe file is now fine, so I know I have some type of virus.

I have tried several different types of virus scanners, Spyware Doctor, Avast, etc., but none of them can identify the problem.

Is there any way to track who/what made modifications to a file?

Can you help me?

Thanks….

[Advertisements]

Download Filemon have it run on start-up; make sure you enable filters in it, filter by including only C:\winnt\system32\regsvr32.exe. You might find whats trying to access regsvr32.exe. Don't forget to remove Filemon from startup after you finish

If you suspect a malware infection; Please go to themalware forum and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.

[darth_ash]

Download Filemon have it run on start-up; make sure you enable filters in it, filter by including only C:\winnt\system32\regsvr32.exe. You might find whats trying to access regsvr32.exe. Don't forget to remove Filemon from startup after you finish

If you suspect a malware infection; Please go to themalware forum and follow the instructions at the top....Especially the CLICK HERE .

That will give you several steps that will help you clean up 70 percent of all problems by yourself. If at the end of the process you are still having difficulty--and you may not be-- then post a hijackthis log in THAT forum.

If you are still having problems after getting a clean bill of health from the malware expert, please return to this thread.